From 0dfe8c32234ede7fa4c2689c76718af0d07584e8 Mon Sep 17 00:00:00 2001 From: Rob Jagger <116566+jagger@users.noreply.github.com> Date: Tue, 6 Jan 2026 13:29:07 -0500 Subject: [PATCH 1/4] Enhance ServiceNow integration with improved logging, validation, and documentation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Discovery Script Improvements (ServiceNow Account Discovery.ps1) ### Logging Enhancements - Moved log path definitions to top of script with configurable $logFolder variable - Added helper functions: Get-TruncatedSecret, Get-SanitizedHeaders, Write-ApiCallLog - Added debug logging for all input parameters with truncated secrets (5 chars + ***) - Added API call logging for all REST method calls with sanitized Authorization headers - Changed results output from text append to JSON format with Out-File -Force ### Input Validation - Added validation for DiscoveryMode (must be "Advanced" or "Default") - Added validation for baseURL (must start with "https://") - Added placeholder detection to catch unsubstituted Secret Server variables - Validation logs errors before throwing exceptions for easier troubleshooting ### Code Quality - Renamed functions to use PowerShell approved verbs: - isadmin -> Test-IsAdminUser - isSvcAcct -> Test-IsServiceAccount - isLocal -> Test-IsLocalUser - get-SvcAccounts -> Get-ServiceAccounts - Fixed hardcoded URL bug in Get-LocalUsers function (now uses $api variable) ## XML Template Fixes ### ServiceNow Privileged Account Template.xml - Fixed "ClientUD" typo to "ClientID" - Fixed "Local-Account-Groud-Ids" typo to "Local-Account-Group-Ids" - Added description for Local-Account-Group-Ids field - Set Password and Client-Secret fields as password type (masked in UI) ### ServiceNow User Template.xml - Fixed "assocated" typo to "associated" ## Documentation Updates ### Main readme.md - Added Native Support Notice about Secret Server's built-in ServiceNow support - Added link to official Delinea documentation - Noted this repo offers alternate implementation with discovery features ### Instructions.md - Added missing # header marker - Fixed missing bullet points in Prerequisites section - Fixed "training slash" -> "trailing slash" typo - Fixed "ministrative" -> "administrative" typo ### Discovery/readme.md - Added Log Files documentation section - Added Input Validation documentation - Added Discovery Mode Options table - Fixed multiple typos and formatting issues ### Remote Password Changer/readme.md - Fixed double slash in link path - Fixed double colon in Category field - Fixed triple asterisks in bold formatting - Fixed "fill outhe" -> "fill out the" typo - Fixed "pasge" -> "page" typo - Fixed missing bold closing tag ### Templates/readme.md (New) - Created new readme documenting available templates - Added native support notice - Added field descriptions for both templates - Added import instructions 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 --- .../ServiceNow Account Discovery.ps1 | 213 ++++++++++++++---- .../ServiceNow/Discovery/readme.md | 60 +++-- .../SecretServer/ServiceNow/Instructions.md | 10 +- .../Remote Password Changer/readme.md | 16 +- ...ServiceNow Privileged Account Template.xml | 14 +- .../Templates/ServiceNow User Template.xml | 2 +- .../ServiceNow/Templates/readme.md | 58 +++++ Scripts/SecretServer/ServiceNow/readme.md | 11 +- 8 files changed, 305 insertions(+), 79 deletions(-) diff --git a/Scripts/SecretServer/ServiceNow/Discovery/ServiceNow Account Discovery.ps1 b/Scripts/SecretServer/ServiceNow/Discovery/ServiceNow Account Discovery.ps1 index ce0f6d4..4d7a1f0 100644 --- a/Scripts/SecretServer/ServiceNow/Discovery/ServiceNow Account Discovery.ps1 +++ b/Scripts/SecretServer/ServiceNow/Discovery/ServiceNow Account Discovery.ps1 @@ -1,8 +1,16 @@ -# Expected Argd args=@("Discovery Mode Advanced/Default"Service Now Tenenant Base URL",SNOW Priovileged Username","SNOW Priovileged Password",""SNOW Client ID","SNOW Client Secret" ,"Private Key" ,"Admin Role ID","Local Group ID" ) +# Expected Args args=@("Discovery Mode Advanced/Default","Service Now Tenant Base URL",SNOW Privileged Username","SNOW Privileged Password","SNOW Client ID","SNOW Client Secret" ,"Private Key" ,"Admin Role ID","Local Group ID" ) -#region define variables -#Define Argument Variables +#region Log Configuration +# Log settings - modify these values as needed +[string]$logFolder = "$env:ProgramFiles\Thycotic Software Ltd\Distributed Engine\log" +[string]$LogFile = "$logFolder\ServiceNow-Discovery.log" +[string]$ResultsFile = "$logFolder\ServiceNow-Discovery-Results.json" +[int32]$LogLevel = 3 +[string]$logApplicationHeader = "ServiceNow Discovery" +#endregion Log Configuration +#region Define Variables +#Define Argument Variables [string]$DiscoveryMode = $args[0] [string]$baseURL = $args[1] [string]$tokenUrl = "$baseURL/oauth_token.do" @@ -15,17 +23,7 @@ [string]$svcAcctGroupId = $args[7] [string]$localGroupId = $args[8] -<# -The following is for debuging Parameters being sent by Secret Server - -$value = "$baseURL $username $password $clientId $clientSecret $adminRole $svcAcctGroupId $localGroupId" -Add-Content -Path "c:\temp\snoq.txt" -Value $value -#> - #Script Constants -[string]$LogFile = "$env:ProgramFiles\Thycotic Software Ltd\Distributed Engine\log\ServiceNow-Discovery.log" -[int32]$LogLevel = 3 -[string]$logApplicationHeader = "ServiceNow Discovery" [string]$scope = "useraccount" #endregion @@ -58,6 +56,118 @@ function Write-Log { } #endregion Error Handling Functions +#region Helper Functions +function Test-PlaceholderValue { + param( + [string]$Value, + [string]$PlaceholderKeyword, + [string]$ParameterName + ) + if ($Value.StartsWith('$') -and $Value -match $PlaceholderKeyword) { + Write-Log -ErrorLevel 2 -Message "Invalid parameter '$ParameterName': Value appears to be an unsubstituted placeholder ('$Value')" + throw "Parameter '$ParameterName' contains an unsubstituted placeholder value. Please check Secret Server configuration." + } +} + +function Get-TruncatedSecret { + param( + [string]$Secret, + [int]$Length = 5 + ) + if ([string]::IsNullOrEmpty($Secret)) { + return "[empty]" + } + if ($Secret.Length -le $Length) { + return "$Secret***" + } + return "$($Secret.Substring(0, $Length))***" +} + +function Get-SanitizedHeaders { + param( + [hashtable]$Headers + ) + $sanitized = @{} + foreach ($key in $Headers.Keys) { + if ($key -eq "Authorization") { + $sanitized[$key] = "Bearer [REDACTED]" + } else { + $sanitized[$key] = $Headers[$key] + } + } + return ($sanitized | ConvertTo-Json -Compress) +} + +function Write-ApiCallLog { + param( + [string]$Method, + [string]$Uri, + [hashtable]$Headers, + [object]$Body = $null + ) + Write-Log -ErrorLevel 3 -Message "API Call: $Method $Uri" + Write-Log -ErrorLevel 3 -Message "Headers: $(Get-SanitizedHeaders -Headers $Headers)" + if ($Body) { + $sanitizedBody = $Body.Clone() + if ($sanitizedBody.ContainsKey('password')) { + $sanitizedBody['password'] = Get-TruncatedSecret -Secret $sanitizedBody['password'] + } + if ($sanitizedBody.ContainsKey('client_secret')) { + $sanitizedBody['client_secret'] = Get-TruncatedSecret -Secret $sanitizedBody['client_secret'] + } + Write-Log -ErrorLevel 3 -Message "Body: $($sanitizedBody | ConvertTo-Json -Compress)" + } +} +#endregion Helper Functions + +#region Log Input Parameters +Write-Log -ErrorLevel 3 -Message "=== Script Parameters ===" +Write-Log -ErrorLevel 3 -Message "DiscoveryMode: $DiscoveryMode" +Write-Log -ErrorLevel 3 -Message "baseURL: $baseURL" +Write-Log -ErrorLevel 3 -Message "username: $username" +Write-Log -ErrorLevel 3 -Message "password: $(Get-TruncatedSecret -Secret $password)" +Write-Log -ErrorLevel 3 -Message "clientId: $clientId" +Write-Log -ErrorLevel 3 -Message "clientSecret: $(Get-TruncatedSecret -Secret $clientSecret)" +Write-Log -ErrorLevel 3 -Message "adminRole: $adminRole" +Write-Log -ErrorLevel 3 -Message "svcAcctGroupId: $svcAcctGroupId" +Write-Log -ErrorLevel 3 -Message "localGroupId: $localGroupId" +Write-Log -ErrorLevel 3 -Message "=========================" +#endregion Log Input Parameters + +#region Validate Input Parameters +Write-Log -ErrorLevel 0 -Message "Validating input parameters" + +# Validate DiscoveryMode +if ($DiscoveryMode -notin @('Advanced', 'Default')) { + Write-Log -ErrorLevel 2 -Message "Invalid DiscoveryMode: '$DiscoveryMode'. Must be 'Advanced' or 'Default'" + throw "Invalid DiscoveryMode: '$DiscoveryMode'. Must be 'Advanced' or 'Default'" +} + +# Validate baseURL starts with https:// +if (-not $baseURL.StartsWith('https://')) { + Write-Log -ErrorLevel 2 -Message "Invalid baseURL: '$baseURL'. Must start with 'https://'" + throw "Invalid baseURL: '$baseURL'. Must start with 'https://'" +} + +# Validate required parameters are not unsubstituted placeholders +Test-PlaceholderValue -Value $username -PlaceholderKeyword 'username' -ParameterName 'username' +Test-PlaceholderValue -Value $password -PlaceholderKeyword 'pass' -ParameterName 'password' +Test-PlaceholderValue -Value $clientId -PlaceholderKeyword 'client' -ParameterName 'clientId' +Test-PlaceholderValue -Value $clientSecret -PlaceholderKeyword 'client' -ParameterName 'clientSecret' + +# Validate optional parameters if provided +if ($adminRole) { + Test-PlaceholderValue -Value $adminRole -PlaceholderKeyword 'role' -ParameterName 'adminRole' +} +if ($svcAcctGroupId) { + Test-PlaceholderValue -Value $svcAcctGroupId -PlaceholderKeyword 'group' -ParameterName 'svcAcctGroupId' +} +if ($localGroupId) { + Test-PlaceholderValue -Value $localGroupId -PlaceholderKeyword 'local' -ParameterName 'localGroupId' +} + +Write-Log -ErrorLevel 0 -Message "Input parameters validated successfully" +#endregion Validate Input Parameters #region Get Access Token #Get Access Token @@ -72,13 +182,17 @@ try { password = $password scope = $scope } + # Log API call (token endpoint - no auth header yet) + Write-Log -ErrorLevel 3 -Message "API Call: POST $tokenUrl" + Write-Log -ErrorLevel 3 -Message "Body: grant_type=password, client_id=$clientId, client_secret=$(Get-TruncatedSecret -Secret $clientSecret), username=$username, password=$(Get-TruncatedSecret -Secret $password), scope=$scope" + # Make a POST request to obtain the token $response = Invoke-RestMethod -Uri $tokenUrl -Method POST -Body $body # Extract the access token from the response $accessToken = $response.access_token - Write-Log -Errorlevel 0 -Message "Access Tiken Successfuly Obtailed " + Write-Log -Errorlevel 0 -Message "Access Token Successfully Obtained " } catch { @@ -94,7 +208,7 @@ catch { #region Discovery Filtering Functions <# The ys Admin and isSvcAcct Functions will not be used in Default mode#> -function isadmin{ +function Test-IsAdminUser { param( $adminUsers, $userId @@ -128,7 +242,7 @@ function isadmin{ $isadmin } -function isSvcAcct{ +function Test-IsServiceAccount { param( $svcAccts, $userId @@ -164,7 +278,7 @@ catch return $isSvcAcct } -function isLocal{ +function Test-IsLocalUser { param( $localUsers, $userId @@ -221,8 +335,11 @@ function isLocal{ # Specify HTTP method $method = "get" + # Log API call + Write-ApiCallLog -Method $method -Uri $uri -Headers $headers + # Send HTTP request - $users = Invoke-RestMethod -Headers $headers -Method $method -Uri $uri + $users = Invoke-RestMethod -Headers $headers -Method $method -Uri $uri } catch { @@ -236,7 +353,7 @@ catch { #region get admin users # Fetching users associated with this role -function get-AdminUsers{ +function Get-AdminUsers { try { Write-Log -Errorlevel 0 -Message "Retrieving List of Admin Users" ##Create Roles Array @@ -245,7 +362,7 @@ function get-AdminUsers{ { ### Create Array of Admin Roles - #Clear Parametwr List + #Clear Parameter List $sysparm_querry = "" $adminRoleArray = $adminRole.split(",") foreach ($role in $uri =$adminRoleArray ) { @@ -259,9 +376,11 @@ function get-AdminUsers{ } } - $uri = "$api/table/sys_user_has_role?sysparm_query=$sysparm_querry" + $uri = "$api/table/sys_user_has_role?sysparm_query=$sysparm_querry" + # Log API call + Write-ApiCallLog -Method "GET" -Uri $uri -Headers $headers $adminUsers = Invoke-RestMethod -Uri $uri -Headers $headers -Method Get - Write-Log -ErrorLevel 0 -Message "Sueccessfully found $($adminUsers.result.Count) Admin Accounts" + Write-Log -ErrorLevel 0 -Message "Successfully found $($adminUsers.result.Count) Admin Accounts" } @@ -280,7 +399,7 @@ return $adminUsers #region get Service Accounts # Fetching Accounts associated with this/these Group/s -function get-SvcAccounts{ +function Get-ServiceAccounts { try { Write-Log -Errorlevel 0 -Message "Retrieving List of Service Accounts" ##Create Roles Array @@ -301,9 +420,11 @@ function get-SvcAccounts{ $sysparm_querry = "$sysparm_querry^ORgroup=$groupId" } } - $uri = "$api/table/sys_user_grmember?sysparm_query=$sysparm_querry" + $uri = "$api/table/sys_user_grmember?sysparm_query=$sysparm_querry" + # Log API call + Write-ApiCallLog -Method "GET" -Uri $uri -Headers $headers $svcAccountIds = Invoke-RestMethod -Uri $uri -Headers $headers -Method Get - Write-Log -ErrorLevel 0 -Message "Sueccessfully found $($svcAccountIds.result.Count) SErvice Accounts" + Write-Log -ErrorLevel 0 -Message "Successfully found $($svcAccountIds.result.Count) Service Accounts" } @@ -320,7 +441,7 @@ return $svcAccountIds #endregion Get Admin Users #region Get Local Users -function get-LocalUsers{ +function Get-LocalUsers { try{ @@ -329,16 +450,17 @@ function get-LocalUsers{ { # Specify endpoint uri - $uri = "https://authteam02904.service-now.com/api/now/table/sys_user_grmember?sysparm_query=group=$localGroupId" - - # Specify HTTP method - $method = "get" - + $uri = "$api/table/sys_user_grmember?sysparm_query=group=$localGroupId" + # Specify HTTP method $method = "get" + + # Log API call + Write-ApiCallLog -Method $method -Uri $uri -Headers $headers + # Send HTTP request - $LocalUsers= Invoke-RestMethod -Headers $headers -Method $method -Uri $uri - Write-Log -ErrorLevel 0 -Message "Sueccessfully found $($LocalUsers.result.Count) SErvice Accounts" + $LocalUsers= Invoke-RestMethod -Headers $headers -Method $method -Uri $uri + Write-Log -ErrorLevel 0 -Message "Successfully found $($LocalUsers.result.Count) Local Accounts" } } @@ -362,11 +484,11 @@ return $LocalUsers if($DiscoveryMode = "Advanced"){ - $adminUsers = get-AdminUsers - $svcAccountIds = get-SvcAccounts + $adminUsers = Get-AdminUsers + $svcAccountIds = Get-ServiceAccounts } -$LocalUsers = get-LocalUsers +$LocalUsers = Get-LocalUsers #endregion #define Output Array @@ -386,12 +508,12 @@ Try { if ($localGroupId) { - $isLocal = isLocal -localUsers $LocalUsers -userId $userId + $isLocal = Test-IsLocalUser -localUsers $LocalUsers -userId $userId } else { <#ServiceNow note Check if Federated Id has a Value. Typical value is something - Like YCqviKocof/+7pmCk6IXdayQzerT2v5t1NozqEV2l+I= . If Federated there would be a Value afte rth = sign #> + Like YCqviKocof/+7pmCk6IXdayQzerT2v5t1NozqEV2l+I= . If Federated there would be a Value after the = sign #> if (!$user.federated_id.Split("=")[1] ) { @@ -427,7 +549,7 @@ Try { ### check if is admin if($adminRole) { - $isadmin = isadmin -adminUsers $adminUsers -userId $userId + $isadmin = Test-IsAdminUser -adminUsers $adminUsers -userId $userId } else { @@ -437,7 +559,7 @@ Try { #Check Service Account if ($svcAcctGroupId) { - $isServiceAccount = isSvcAcct -svcAccts $svcAccountIds -userId $userId + $isServiceAccount = Test-IsServiceAccount -svcAccts $svcAccountIds -userId $userId } else { @@ -451,12 +573,12 @@ Try { if ($localGroupId) { - $isLocal = isLocal -localUsers $LocalUsers -userId $userId + $isLocal = Test-IsLocalUser -localUsers $LocalUsers -userId $userId } else { <#Check if Federated Id has a Value. Typical value is something - Like YCqviKocof/+7pmCk6IXdayQzerT2v5t1NozqEV2l+I= . If Federated there would be a Value afte rth = sign #> + Like YCqviKocof/+7pmCk6IXdayQzerT2v5t1NozqEV2l+I= . If Federated there would be a Value after the = sign #> if (!$user.federated_id.Split("=")[1] ) { @@ -497,7 +619,12 @@ catch { throw $Err.Exception } #endregion Main Process -Add-Content -Path "c:\temp\results.txt" -Value $foundAccounts + +# Write results to JSON file +Write-Log -ErrorLevel 0 -Message "Writing $($foundAccounts.Count) discovered accounts to $ResultsFile" +$foundAccounts | ConvertTo-Json -Depth 10 | Out-File -FilePath $ResultsFile -Encoding utf8 -Force +Write-Log -ErrorLevel 0 -Message "Discovery completed successfully" + return $foundAccounts diff --git a/Scripts/SecretServer/ServiceNow/Discovery/readme.md b/Scripts/SecretServer/ServiceNow/Discovery/readme.md index 28e5605..26f7f12 100644 --- a/Scripts/SecretServer/ServiceNow/Discovery/readme.md +++ b/Scripts/SecretServer/ServiceNow/Discovery/readme.md @@ -1,10 +1,35 @@ # ServiceNow Account Discovery -## Create Discovery Source +This scanner will perform discovery of ServiceNow Accounts. - +## Log Files + +The discovery script writes to the following log files in the Distributed Engine log folder: + +| File | Description | +|------|-------------| +| `ServiceNow-Discovery.log` | Main application log with INFO, WARN, ERROR, and DEBUG messages | +| `ServiceNow-Discovery-Results.json` | JSON file containing discovered accounts | + +**Default Location:** `%ProgramFiles%\Thycotic Software Ltd\Distributed Engine\log\` + +The log level can be adjusted by modifying the `$LogLevel` variable at the top of the script: +- `0` = INFO only +- `1` = INFO + WARN +- `2` = INFO + WARN + ERROR +- `3` = All messages including DEBUG (default) -This scanner will perform discovery of ServiceNow Accounts +## Input Validation + +The script validates all input parameters before execution: + +| Parameter | Validation | +|-----------|------------| +| DiscoveryMode | Must be "Advanced" or "Default" | +| tenant-url | Must start with "https://" | +| All credentials | Checked for unsubstituted placeholder values (e.g., `$username`) | + +If validation fails, the script logs an error and terminates before making any API calls. ## Create Discovery Source @@ -74,7 +99,7 @@ This scanner will perform discovery of ServiceNow Accounts - Log in to Secret Server Tenant (If you have not already done so) -- Navigate to**Admin** > **Scripts** +- Navigate to **Admin** > **Scripts** - Click on **Create Script** @@ -92,7 +117,7 @@ This scanner will perform discovery of ServiceNow Accounts - **Merge Fields:** Leave Blank - - **Script:** Copy and paste the Script included in the file [ServiceNow Account Account Discovery](./ServiceNow%20Account%20Discovery.ps1) + - **Script:** Copy and paste the Script included in the file [ServiceNow Account Discovery](./ServiceNow%20Account%20Discovery.ps1) - Click Save @@ -112,7 +137,7 @@ This scanner will perform discovery of ServiceNow Accounts - Fill out the required fields: - - **Name:** > ServiceNow Tenant Scanner + - **Name:** ServiceNow Tenant Scanner - **Description:** (Example - Base scanner used to discover ServiceNow Tenants) @@ -150,18 +175,25 @@ This scanner will perform discovery of ServiceNow Accounts - **Base Scanner:** PowerShell Discovery - - **Input Template:** Select the ServiceNow Tenant Scan Template that Was Created in the [ServiceNow Tenant Scan Template Section](#create-servicenow-tenant-scan-template)) + - **Input Template:** Select the ServiceNow Tenant Scan Template that Was Created in the [ServiceNow Tenant Scan Template Section](#create-servicenow-tenant-scan-template) - - **Output Template::** Select the ServiceNow Account Scan Template (Use Template that Was Created in the [Create Account Scan Template Section](#create-servicenow-account-scan-template)) + - **Output Template:** Select the ServiceNow Account Scan Template (Use Template that Was Created in the [Create Account Scan Template Section](#create-servicenow-account-scan-template)) - **Script:** ServiceNow Account Scanner (Use Script Created in the [Create Discovery Script Section](#create-discovery-script)) - - **Script Arguments:** + - **Script Arguments:** (Use `Advanced` or `Default` for the first argument) ``` powershell - Advanced $[1]$tenant-url $[1]$username $[1]$password $[1]$client-id $[1]$client-secret $[1]$admin-roles $[1]$sac-groupids $[1]$local-acct-grpids** + Advanced $[1]$tenant-url $[1]$username $[1]$password $[1]$client-id $[1]$client-secret $[1]$admin-roles $[1]$svc-groupids $[1]$local-acct-grpids ``` - Click Save +#### Discovery Mode Options + +| Mode | Description | +|------|-------------| +| **Advanced** | Discovers admin accounts, service accounts, and local accounts. Requires admin-roles, svc-groupids, and local-acct-grpids parameters. | +| **Default** | Discovers local accounts only. Uses federated_id field to determine if account is local. | + ### Create Discovery Source @@ -174,7 +206,7 @@ This scanner will perform discovery of ServiceNow Accounts - Select **Empty Discovery Source** --Enter the Values below: +- Enter the Values below: - **Name:** (example: ServiceNow Test Tenant) @@ -188,11 +220,11 @@ This scanner will perform discovery of ServiceNow Accounts - Click **Add Scanner** -- Find the ServiceNow Tenant Scanner or the Scanner Created in the [Create ServiceNow Tenant Scanner Section](#create-saas-tenant-scanner) and Click **Add Scanner** +- Find the ServiceNow Tenant Scanner or the Scanner Created in the [Create ServiceNow Tenant Scanner Section](#create-servicenow-tenant-scanner) and Click **Add Scanner** - Select the Scanner just Created and Click **Edit Scanner** -- In the **lines Parse Format** Section Enter the Source Name (example: ServiceNow Tenant) +- In the **Lines Parse Format** Section Enter the Source Name (example: ServiceNow Tenant) - Click **Save** @@ -295,4 +327,4 @@ You will now find this report under the section you chose in the Category field. - Click on the **Network view** tab -- You should now see the discovered Accounts. Use the filer option to find the Accounts easier \ No newline at end of file +- You should now see the discovered Accounts. Use the filter option to find the Accounts easier \ No newline at end of file diff --git a/Scripts/SecretServer/ServiceNow/Instructions.md b/Scripts/SecretServer/ServiceNow/Instructions.md index 6869e46..bd49961 100644 --- a/Scripts/SecretServer/ServiceNow/Instructions.md +++ b/Scripts/SecretServer/ServiceNow/Instructions.md @@ -1,4 +1,4 @@ - ServiceNow Connector Overview +# ServiceNow Connector Overview This connector provides the following functions: @@ -17,7 +17,7 @@ This connector utilizes an OAuth 2.0 application in ServiceNow using the client ### Prerequisites - Access to a ServiceNow instance with administrative privileges. -Basic understanding of OAuth 2.0 and ServiceNow administration. +- Basic understanding of OAuth 2.0 and ServiceNow administration. ## Create an OAuth Application Registry @@ -28,7 +28,7 @@ For more information click [here](https://docs.servicenow.com/bundle/vancouver-p - Document the following values as they will be needed in the upcoming sections: - clientId, clientSecret, username, and password - . The username and password should be the credential that has the permissions to Discover Users and Change their Passwords + - The username and password should be the credential that has the permissions to Discover Users and Change their Passwords ## Creating Secret Template for ServiceNow Accounts @@ -62,12 +62,12 @@ The following steps are required to create the Secret Template for ServiceNow Pr - Select the template created in the earlier step [above](#servicenow-privileged-account-template). - Fill out the required fields with the information from the application registration - **Secret Name:** (for example ServiceNow API Account ) - - **tenant-url:** (ServiceNow base url with no training slash) + - **tenant-url:** (ServiceNow base url with no trailing slash) - **Username:** (Created in the create App Registration [above](#create-an-oauth-application-registry)) - **Password:** (Created in the create App Registration [above](#create-an-oauth-application-registry)) - **Client-id:** (Created in the create App Registration [above](#create-an-oauth-application-registry)) - **client-secret:** (Created in the create App Registration [above](#create-an-oauth-application-registry)) - - **Admin-Roles:** add a comma separated list of all roles that are considered to be an ministrative user in the format of - role Name=role_sys_id (Example: admin=2831a114c611228501d4ea6c309d626d) + - **Admin-Roles:** add a comma separated list of all roles that are considered to be an administrative user in the format of - role Name=role_sys_id (Example: admin=2831a114c611228501d4ea6c309d626d) - **Service-Account-Group-Ids:** add a comma separated list of all groups that are considered to be a Service Account in the Service-Account (Example: Engine Admins=c38f00f4530360100999ddeeff7b1298) - Click Create Secret diff --git a/Scripts/SecretServer/ServiceNow/Remote Password Changer/readme.md b/Scripts/SecretServer/ServiceNow/Remote Password Changer/readme.md index 44ecf46..f27760b 100644 --- a/Scripts/SecretServer/ServiceNow/Remote Password Changer/readme.md +++ b/Scripts/SecretServer/ServiceNow/Remote Password Changer/readme.md @@ -6,7 +6,7 @@ The steps below show how to Set up and configure a ServiceNow Remote Password Ch -If you have not already done, so, please follow the steps in the **Instructions Document** found [here](..//Instructions.md) +If you have not already done, so, please follow the steps in the **Instructions Document** found [here](../Instructions.md) @@ -63,7 +63,7 @@ If you have not already done, so, please follow the steps in the **Instructions - **Script Type:** Powershell - - **Category::** Heartbeat + - **Category:** Heartbeat - **Merge Fields:** Leave Blank @@ -80,11 +80,11 @@ If you have not already done, so, please follow the steps in the **Instructions - Navigate to **Admin** > **Remote Password Changing** -- Click on Options (dropdown List) and select ***Configure Password Changers** +- Click on Options (dropdown List) and select **Configure Password Changers** - Click on Create Password Changer -- Click on ***Base Password Changer* (Dropdown List) and Select PowerShell Script +- Click on **Base Password Changer** (Dropdown List) and Select PowerShell Script - Enter a Name (Example - ServiceNow Remote Password Changer ) @@ -128,7 +128,7 @@ If you have not already done, so, please follow the steps in the **Instructions - Select the **Mapping** Tab -- In the **Password Changing** section, click edit and fill outhe following +- In the **Password Changing** section, click edit and fill out the following - **Enable RPC** Checked @@ -159,11 +159,11 @@ If you have not already done, so, please follow the steps in the **Instructions - Navigate to **Admin** > **Remote Password Changing** -- Click on Options (dropdown List) and select ***Configure Password Changers** +- Click on Options (dropdown List) and select **Configure Password Changers** - Select the ServiceNow Remote Password Changer or the Password Changer created in the [Create Password Changer](#create-password-changer) section -- Click **Configure Scan Template at the bottom of the pasge** +- Click **Configure Scan Template at the bottom of the page** - Click Edit @@ -173,7 +173,7 @@ If you have not already done, so, please follow the steps in the **Instructions - **tenant-url** -> Domain - - **Username -> username + - **Username** -> username - **Password** -> password diff --git a/Scripts/SecretServer/ServiceNow/Templates/ServiceNow Privileged Account Template.xml b/Scripts/SecretServer/ServiceNow/Templates/ServiceNow Privileged Account Template.xml index 5953942..1de9a08 100644 --- a/Scripts/SecretServer/ServiceNow/Templates/ServiceNow Privileged Account Template.xml +++ b/Scripts/SecretServer/ServiceNow/Templates/ServiceNow Privileged Account Template.xml @@ -49,7 +49,7 @@ Example: https://MyInstance.Servicenow.com Password true false - false + true false false @@ -64,7 +64,7 @@ Example: https://MyInstance.Servicenow.com client-id - ServiceNow API Application ClientUD + ServiceNow API Application ClientID client-id true false @@ -87,7 +87,7 @@ Example: https://MyInstance.Servicenow.com Client-Secret true false - false + true false false @@ -139,9 +139,9 @@ Example: https://MyInstance.Servicenow.com false - Local-Account-Groud-Ids - - Local-Account-Groud-Ids + Local-Account-Group-Ids + Accounts that are part of these groups will be identified as local accounts + Local-Account-Group-Ids true false false @@ -154,7 +154,7 @@ Example: https://MyInstance.Servicenow.com false 2 false - Local-Account-Groud-Ids + Local-Account-Group-Ids false diff --git a/Scripts/SecretServer/ServiceNow/Templates/ServiceNow User Template.xml b/Scripts/SecretServer/ServiceNow/Templates/ServiceNow User Template.xml index 7fe8431..5d3a9ed 100644 --- a/Scripts/SecretServer/ServiceNow/Templates/ServiceNow User Template.xml +++ b/Scripts/SecretServer/ServiceNow/Templates/ServiceNow User Template.xml @@ -27,7 +27,7 @@ Example: https://MyInstance.Servicenow.com Username - The name assocated with the password. + The name associated with the password. Username true false diff --git a/Scripts/SecretServer/ServiceNow/Templates/readme.md b/Scripts/SecretServer/ServiceNow/Templates/readme.md index e69de29..243fa29 100644 --- a/Scripts/SecretServer/ServiceNow/Templates/readme.md +++ b/Scripts/SecretServer/ServiceNow/Templates/readme.md @@ -0,0 +1,58 @@ +# ServiceNow Secret Templates + +## Native Support Notice + +Secret Server now includes native out-of-the-box support for ServiceNow password changing and built-in templates. These custom templates remain fully functional and can be used when: + +- You need additional custom fields not available in the native templates +- You require specific field configurations for your organization +- You are using an older version of Secret Server without native ServiceNow support + +## Templates Included + +### ServiceNow Privileged Account Template + +**File:** `ServiceNow Privileged Account Template.xml` + +Used for storing credentials that authenticate to the ServiceNow API for discovery and password management operations. + +| Field | Required | Description | +|-------|----------|-------------| +| Tenant-url | Yes | Base URL for the ServiceNow instance (e.g., `https://myinstance.service-now.com`) | +| Username | Yes | Username for OAuth authentication to ServiceNow API | +| Password | Yes | Password for the username (masked field) | +| client-id | Yes | ServiceNow API Application Client ID | +| Client-Secret | Yes | ServiceNow API Application Client Secret (masked field) | +| Admin-Roles | No | Role IDs used to identify admin accounts during discovery | +| Service-Account-Group-Ids | No | Group IDs used to identify service accounts during discovery | +| Local-Account-Group-Ids | No | Group IDs used to identify local accounts during discovery | + +### ServiceNow User Template + +**File:** `ServiceNow User Template.xml` + +Used for storing discovered ServiceNow user account credentials. + +| Field | Required | Description | +|-------|----------|-------------| +| Tenant-URL | Yes | Base URL for the ServiceNow instance | +| Username | No | The account username | +| Password | Yes | The account password (masked field) | +| Notes | No | Additional comments or information | +| Admin-Account | No | Indicates if the account is an admin | +| Service Account | No | Indicates if the account is a service account | +| Local Account | No | Indicates if the account is a local account | + +## Importing Templates + +1. Log in to Secret Server +2. Navigate to **Admin** > **Secret Templates** +3. Click **Import** +4. Select the XML template file +5. Click **Import** + +## Related Documentation + +- [Discovery Configuration](../Discovery/readme.md) +- [Remote Password Changer Configuration](../Remote%20Password%20Changer/readme.md) +- [ServiceNow Setup Instructions](../Instructions.md) diff --git a/Scripts/SecretServer/ServiceNow/readme.md b/Scripts/SecretServer/ServiceNow/readme.md index 6f48e5b..5a218ab 100644 --- a/Scripts/SecretServer/ServiceNow/readme.md +++ b/Scripts/SecretServer/ServiceNow/readme.md @@ -1,6 +1,15 @@ # ServiceNow Delinea Secret Server Integration - +## Native Support Notice + +Secret Server now includes native out-of-the-box support for ServiceNow password changing and heartbeat functionality. For the built-in implementation, see the [official ServiceNow RPC Integration documentation](https://docs.delinea.com/online-help/integrations/servicenow/rpc-config/servicenow-rpc-integration.htm). + +This repository provides an alternate RPC and Heartbeat implementation that offers: +- Customization options for specific organizational requirements +- Account Discovery features not available in the native Secret Server implementation +- Flexibility for older Secret Server versions without native ServiceNow support + +## Overview This package is designed to discover and Manage ServiceNow User Accounts. It will provide detailed instructions and the necessary Scripts to perform these functions. Before beginning to implement any of the specific processes it is a requirement to perform the tasks contained in the Instructions document which can be found [here](./Instructions.md) From 588e8892222f1430f7d1f96d9a15b087626a4ced Mon Sep 17 00:00:00 2001 From: Rob Jagger <116566+jagger@users.noreply.github.com> Date: Thu, 8 Jan 2026 13:24:02 -0500 Subject: [PATCH 2/4] Fix typos and syntax errors in Remote Password Changer scripts MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ServiceNow Heartbeat.ps1: - Fixed "Argumnts" -> "Arguments" in comment - Fixed "Vaeiables" -> "Variables" in region name - Fixed invalid env var path "$env:Program Files" -> "$env:ProgramFiles" - Fixed missing closing brace in Write-Log function - Fixed parameter name mismatch "$privassword" -> "$privPassword" - Renamed function "get-pwd-verification" -> "Test-PasswordVerification" - Fixed parameter/variable mismatch $PWD/$Password ServiceNow Remote Password Changer.ps1: - Fixed "Argumnts" -> "Arguments" in comment - Fixed "Vaeiables" -> "Variables" in region name - Fixed invalid env var path "$env:Program Files" -> "$env:ProgramFiles" - Fixed "#endregikon" -> "#endregion" typo - Fixed parameter name mismatch "$privassword" -> "$privPassword" - Fixed "Funtions" -> "Functions" in region name - Fixed function name "get-ServiceNowUserInfo" -> "Get-ServiceNowUserInfo" 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 --- .claude/settings.local.json | 10 +++++++ .../ServiceNow Heartbeat.ps1 | 26 +++++++++---------- .../ServiceNow Remote Password Changer.ps1 | 18 ++++++------- 3 files changed, 32 insertions(+), 22 deletions(-) create mode 100644 .claude/settings.local.json diff --git a/.claude/settings.local.json b/.claude/settings.local.json new file mode 100644 index 0000000..7bf49c2 --- /dev/null +++ b/.claude/settings.local.json @@ -0,0 +1,10 @@ +{ + "permissions": { + "allow": [ + "Bash(git fetch:*)", + "Bash(tee:*)", + "Bash(gh pr create:*)", + "Bash(git add:*)" + ] + } +} diff --git a/Scripts/SecretServer/ServiceNow/Remote Password Changer/ServiceNow Heartbeat.ps1 b/Scripts/SecretServer/ServiceNow/Remote Password Changer/ServiceNow Heartbeat.ps1 index a55cb7e..fb20683 100644 --- a/Scripts/SecretServer/ServiceNow/Remote Password Changer/ServiceNow Heartbeat.ps1 +++ b/Scripts/SecretServer/ServiceNow/Remote Password Changer/ServiceNow Heartbeat.ps1 @@ -1,8 +1,8 @@ -#Expected Argumnts @(,"username", "clientId", "clientSecret", "kid", "tenant", "privuseremail", "privateKeyPEM") +#Expected Arguments @("baseURL", "privUsername", "privPassword", "clientId", "clientSecret", "username", "password") [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 -#region Set Paramaters and Vaeiables +#region Set Parameters and Variables [string]$baseURL = $args[0] [string]$tokenUrl = "$baseURL/oauth_token.do" [string]$api = "$baseURL/api/now" @@ -16,7 +16,7 @@ #Script Constants [string]$scope = "useraccount" -[string]$LogFile = "$env:Program Files\Thycotic Software Ltd\Distributed Engine\log\ServiceNow-Connector.log" +[string]$LogFile = "$env:ProgramFiles\Thycotic Software Ltd\Distributed Engine\log\ServiceNow-Connector.log" [int32]$LogLevel = 3 [string]$logApplicationHeader = "ServiceNow Heartbeat" #endregion @@ -34,7 +34,7 @@ function Write-Log { # Evaluate Log Level based on global configuration if ($ErrorLevel -le $LogLevel) { # Format message - [string]$Timestamp = Get-Date -Format "yyyy-MM-ddThh:mm:sszzz" + [string]$Timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss zzz" switch ($ErrorLevel) { "0" { [string]$MessageLevel = "INF0 " } "1" { [string]$MessageLevel = "WARN " } @@ -44,7 +44,7 @@ function Write-Log { # Write Log data $MessageString = "{0}`t| {1}`t| {2}`t| {3}" -f $Timestamp, $MessageLevel,$logApplicationHeader, $Message $MessageString | Out-File -FilePath $LogFile -Encoding utf8 -Append -ErrorAction SilentlyContinue - + } } #endregion Error Handling Functions @@ -54,7 +54,7 @@ function Get-BearerToken { [Parameter(Mandatory=$true, HelpMessage="Privileged User Name")] [System.String]$privUsername, [Parameter(Mandatory=$true, HelpMessage="Privileged User Password")] - [System.String]$privassword, + [System.String]$privPassword, [Parameter(Mandatory=$false, HelpMessage="scope needed")] [System.String]$Scope, [Parameter(Mandatory=$true, HelpMessage="Root Url to hit to get bearer token")] @@ -87,13 +87,13 @@ function Get-BearerToken { return $token } #endregion -function get-pwd-verification{ +function Test-PasswordVerification { param ( - [Parameter(Mandatory=$true, HelpMessage="Username to check PW")] + [Parameter(Mandatory=$true, HelpMessage="Username to check password")] [System.String]$Username, - [Parameter(Mandatory=$true, HelpMessage="PW val")] - [System.String]$PWD, - [Parameter(Mandatory=$true, HelpMessage="header")] + [Parameter(Mandatory=$true, HelpMessage="Password value")] + [System.String]$Password, + [Parameter(Mandatory=$true, HelpMessage="Request headers")] [hashtable]$headers ) try{ @@ -115,7 +115,7 @@ function get-pwd-verification{ return $result } # -$token = Get-BearerToken -privUsername $privUsername -privassword $privPassword -Scope $scope -Url $tokenUrl -clientId $clientId -clientSecret $clientSecret +$token = Get-BearerToken -privUsername $privUsername -privPassword $privPassword -Scope $scope -Url $tokenUrl -clientId $clientId -clientSecret $clientSecret $headers = @{ "Authorization" = "Bearer $token" "Accept" = "application/json" @@ -123,5 +123,5 @@ $headers = @{ } # - $result = get-pwd-verification -Username $username -PW $password -headers $headers + $result = Test-PasswordVerification -Username $username -Password $password -headers $headers return $result diff --git a/Scripts/SecretServer/ServiceNow/Remote Password Changer/ServiceNow Remote Password Changer.ps1 b/Scripts/SecretServer/ServiceNow/Remote Password Changer/ServiceNow Remote Password Changer.ps1 index 0867273..7d5eb82 100644 --- a/Scripts/SecretServer/ServiceNow/Remote Password Changer/ServiceNow Remote Password Changer.ps1 +++ b/Scripts/SecretServer/ServiceNow/Remote Password Changer/ServiceNow Remote Password Changer.ps1 @@ -1,9 +1,9 @@ -#Expected Argumnts @("username", "password", "clientId", "clientSecret", "kid", "tenant", "privuseremail", "privateKeyPEM") +#Expected Arguments @("baseURL", "privUsername", "privPassword", "clientId", "clientSecret", "username", "newPassword") [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 -#region Set Paramaters and Vaeiables +#region Set Parameters and Variables [string]$baseURL = $args[0] [string]$tokenUrl = "$baseURL/oauth_token.do" [string]$api = "$baseURL/api/now" @@ -17,10 +17,10 @@ #Script Constants [string]$scope = "useraccount" -[string]$LogFile = "$env:Program Files\Thycotic Software Ltd\Distributed Engine\log\ServiceNow-Password_Rotate.log" +[string]$LogFile = "$env:ProgramFiles\Thycotic Software Ltd\Distributed Engine\log\ServiceNow-Password_Rotate.log" [int32]$LogLevel = 3 [string]$logApplicationHeader = "ServiceNow Password Change" -#endregikon +#endregion #region Error Handling Functions function Write-Log { @@ -57,7 +57,7 @@ function Get-BearerToken { [Parameter(Mandatory=$true, HelpMessage="Privileged User Name")] [System.String]$privUsername, [Parameter(Mandatory=$true, HelpMessage="Privileged User Password")] - [System.String]$privassword, + [System.String]$privPassword, [Parameter(Mandatory=$false, HelpMessage="scope needed")] [System.String]$Scope, [Parameter(Mandatory=$true, HelpMessage="Root Url to hit to get bearer token")] @@ -91,9 +91,9 @@ function Get-BearerToken { } #endregion -#region RPC Funtions +#region RPC Functions -function get-ServiceNowUserInfo{ +function Get-ServiceNowUserInfo { param ( [Parameter(Mandatory=$true, HelpMessage="Username to check PW")] [System.String]$Username @@ -143,14 +143,14 @@ function Reset-SNowPassword{ #Region Main Process try { - $token = (Get-BearerToken -Url $tokenUrl -privUsername $privUsername -privassword $privPassword -Scope $scope -clientId $clientId -clientSecret $clientSecret ) + $token = (Get-BearerToken -Url $tokenUrl -privUsername $privUsername -privPassword $privPassword -Scope $scope -clientId $clientId -clientSecret $clientSecret ) $headers = @{ "Authorization" = "Bearer $token" "Accept" = "application/json" "Content-Type" = "application/json" } - $userid = get-ServiceNowUserInfo -Username $username + $userid = Get-ServiceNowUserInfo -Username $username $result = Reset-SNowPassword -Userid $userid -newPassword $password Write-Log -ErrorLevel 0 -Message "Password Successfully Changed" } From 12741c8cd013b6e8475f8d5a183bfdfc5faa8a1f Mon Sep 17 00:00:00 2001 From: Rob Jagger <116566+jagger@users.noreply.github.com> Date: Thu, 8 Jan 2026 13:39:37 -0500 Subject: [PATCH 3/4] Add native support notice to Remote Password Changer readme MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Added notice about Secret Server's native out-of-box ServiceNow password changing and heartbeat support with link to official docs. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 --- .../ServiceNow/Remote Password Changer/readme.md | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/Scripts/SecretServer/ServiceNow/Remote Password Changer/readme.md b/Scripts/SecretServer/ServiceNow/Remote Password Changer/readme.md index f27760b..9922933 100644 --- a/Scripts/SecretServer/ServiceNow/Remote Password Changer/readme.md +++ b/Scripts/SecretServer/ServiceNow/Remote Password Changer/readme.md @@ -1,8 +1,17 @@ # ServiceNow Remote Password Changer - +## Native Support Notice + +Secret Server now includes native out-of-the-box support for ServiceNow password changing and heartbeat functionality. For the built-in implementation, see the [official ServiceNow RPC Integration documentation](https://docs.delinea.com/online-help/integrations/servicenow/rpc-config/servicenow-rpc-integration.htm). + +This custom implementation can be used when: +- You need additional customization not available in the native implementation +- You require specific configurations for your organization +- You are using an older version of Secret Server without native ServiceNow support + +## Overview -The steps below show how to Set up and configure a ServiceNow Remote Password Changer, in Delinea Secret Server. +The steps below show how to set up and configure a ServiceNow Remote Password Changer in Delinea Secret Server. From dfa6ee7cd85ab2e7987e0d0b6c08f2f30e572b37 Mon Sep 17 00:00:00 2001 From: Rob Jagger <116566+jagger@users.noreply.github.com> Date: Thu, 8 Jan 2026 15:29:29 -0500 Subject: [PATCH 4/4] feat(servicenow): rename tenant-url field to host for native RPC compatibility MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Update the ServiceNow User template and discovery output to use 'host' field instead of 'Tenant-URL'/'tenant-url' for compatibility with Secret Server's native ServiceNow RPC implementation. Changes: - ServiceNow User Template.xml: Renamed displayname, name, and fieldslugname - Discovery script: Updated output field name in both Default and Advanced modes - Discovery readme: Updated scan template instructions and SQL report - RPC readme: Updated Password Type Fields and field mapping sections - Templates readme: Updated User Template field documentation 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 --- .../Discovery/ServiceNow Account Discovery.ps1 | 12 +++++------- Scripts/SecretServer/ServiceNow/Discovery/readme.md | 8 ++++---- .../ServiceNow/Remote Password Changer/readme.md | 4 ++-- .../Templates/ServiceNow User Template.xml | 6 +++--- Scripts/SecretServer/ServiceNow/Templates/readme.md | 2 +- 5 files changed, 15 insertions(+), 17 deletions(-) diff --git a/Scripts/SecretServer/ServiceNow/Discovery/ServiceNow Account Discovery.ps1 b/Scripts/SecretServer/ServiceNow/Discovery/ServiceNow Account Discovery.ps1 index 4d7a1f0..0b8216f 100644 --- a/Scripts/SecretServer/ServiceNow/Discovery/ServiceNow Account Discovery.ps1 +++ b/Scripts/SecretServer/ServiceNow/Discovery/ServiceNow Account Discovery.ps1 @@ -40,9 +40,9 @@ function Write-Log { # Evaluate Log Level based on global configuration if ($ErrorLevel -le $LogLevel) { # Format message - [string]$Timestamp = Get-Date -Format "yyyy-MM-ddThh:mm:sszzz" + [string]$Timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss zzz" switch ($ErrorLevel) { - "0" { [string]$MessageLevel = "INF0 " } + "0" { [string]$MessageLevel = "INFO " } "1" { [string]$MessageLevel = "WARN " } "2" { [string]$MessageLevel = "ERROR" } "3" { [string]$MessageLevel = "DEBUG" } @@ -50,8 +50,6 @@ function Write-Log { # Write Log data $MessageString = "{0}`t| {1}`t| {2}`t| {3}" -f $Timestamp, $MessageLevel,$logApplicationHeader, $Message $MessageString | Out-File -FilePath $LogFile -Encoding utf8 -Append -ErrorAction SilentlyContinue - # $Color = @{ 0 = 'Green'; 1 = 'Cyan'; 2 = 'Yellow'; 3 = 'Red'} - # Write-Host -ForegroundColor $Color[$ErrorLevel] -Object ( $DateTime + $Message) } } #endregion Error Handling Functions @@ -431,7 +429,7 @@ function Get-ServiceAccounts { } catch { $Err = $_ - Write-Log -ErrorLevel 0 -Message "Failed to retrieve Service Accountsr List" + Write-Log -ErrorLevel 0 -Message "Failed to retrieve Service Accounts List" Write-Log -ErrorLevel 2 -Message $Err.Exception throw $Err.Exception } @@ -532,7 +530,7 @@ Try { $Username = $user.user_name $object = New-Object -TypeName PSObject - $object | Add-Member -MemberType NoteProperty -Name tenanturl -Value $baseURL + $object | Add-Member -MemberType NoteProperty -Name host -Value $baseURL $object | Add-Member -MemberType NoteProperty -Name username -Value $username $foundAccounts += $object @@ -597,7 +595,7 @@ Try { $Username = $user.user_name $object = New-Object -TypeName PSObject - $object | Add-Member -MemberType NoteProperty -Name tenant-url -Value $baseURL + $object | Add-Member -MemberType NoteProperty -Name host -Value $baseURL $object | Add-Member -MemberType NoteProperty -Name username -Value $username $object | Add-Member -MemberType NoteProperty -Name Admin-Account -Value $isadmin $object | Add-Member -MemberType NoteProperty -Name Service-Account -Value $isServiceAccount diff --git a/Scripts/SecretServer/ServiceNow/Discovery/readme.md b/Scripts/SecretServer/ServiceNow/Discovery/readme.md index 26f7f12..acd8527 100644 --- a/Scripts/SecretServer/ServiceNow/Discovery/readme.md +++ b/Scripts/SecretServer/ServiceNow/Discovery/readme.md @@ -26,7 +26,7 @@ The script validates all input parameters before execution: | Parameter | Validation | |-----------|------------| | DiscoveryMode | Must be "Advanced" or "Default" | -| tenant-url | Must start with "https://" | +| host | Must start with "https://" | | All credentials | Checked for unsubstituted placeholder values (e.g., `$username`) | If validation fails, the script logs an error and terminates before making any API calls. @@ -56,7 +56,7 @@ If validation fails, the script logs an error and terminates before making any A - **Parent Scan Template:** Host Range - - **Fields:** Change HostRange to **tenant-url** + - **Fields:** Change HostRange to **host** - Click Save @@ -84,7 +84,7 @@ If validation fails, the script logs an error and terminates before making any A - **Fields** - - Change Resource to **tenant-url** + - Change Resource to **host** - Add field: Admin-Account (Leave Parent and Include in Match Blank) @@ -292,7 +292,7 @@ d.[ComputerAccountId] ,d.[AccountName] AS [Username] -,MIN(CASE JSON_VALUE([adata].[value],'$.Name') WHEN 'Tenant-url' THEN JSON_VALUE([adata].[value],'$.Value') END) AS [Domain] +,MIN(CASE JSON_VALUE([adata].[value],'$.Name') WHEN 'host' THEN JSON_VALUE([adata].[value],'$.Value') END) AS [Domain] ,MIN(CASE JSON_VALUE([adata].[value],'$.Name') WHEN 'Admin-Account' THEN JSON_VALUE([adata].[value],'$.Value') END) AS [Is Admin Account] diff --git a/Scripts/SecretServer/ServiceNow/Remote Password Changer/readme.md b/Scripts/SecretServer/ServiceNow/Remote Password Changer/readme.md index 9922933..7fa337f 100644 --- a/Scripts/SecretServer/ServiceNow/Remote Password Changer/readme.md +++ b/Scripts/SecretServer/ServiceNow/Remote Password Changer/readme.md @@ -153,7 +153,7 @@ If you have not already done, so, please follow the steps in the **Instructions - In the **Password Type Fields** Section, fill out the following -- **Domain** tenant-url +- **Domain** host - **Password** Password @@ -180,7 +180,7 @@ If you have not already done, so, please follow the steps in the **Instructions - Map the following fields that appear after the selection - - **tenant-url** -> Domain + - **host** -> Domain - **Username** -> username diff --git a/Scripts/SecretServer/ServiceNow/Templates/ServiceNow User Template.xml b/Scripts/SecretServer/ServiceNow/Templates/ServiceNow User Template.xml index 5d3a9ed..d2f10e4 100644 --- a/Scripts/SecretServer/ServiceNow/Templates/ServiceNow User Template.xml +++ b/Scripts/SecretServer/ServiceNow/Templates/ServiceNow User Template.xml @@ -4,12 +4,12 @@ true - Tenant-URL + host This is the base URL for the ServiceNow instance. There should be no trailing / in the address Example: https://MyInstance.Servicenow.com - Tenant-URL + host true true false @@ -22,7 +22,7 @@ Example: https://MyInstance.Servicenow.com true 2 true - tenant-url + host false diff --git a/Scripts/SecretServer/ServiceNow/Templates/readme.md b/Scripts/SecretServer/ServiceNow/Templates/readme.md index 243fa29..e24c0d2 100644 --- a/Scripts/SecretServer/ServiceNow/Templates/readme.md +++ b/Scripts/SecretServer/ServiceNow/Templates/readme.md @@ -35,7 +35,7 @@ Used for storing discovered ServiceNow user account credentials. | Field | Required | Description | |-------|----------|-------------| -| Tenant-URL | Yes | Base URL for the ServiceNow instance | +| host | Yes | Base URL for the ServiceNow instance | | Username | No | The account username | | Password | Yes | The account password (masked field) | | Notes | No | Additional comments or information |